domains / families / security / analyzing-windows-registry-for-artifacts

analyzing-windows-registry-for-artifacts

separate

Extract and analyze Windows Registry hives with tools like RegRipper

When to use

• When investigating user activity on a Windows system during an incident
• For identifying autorun/persistence mechanisms used by malware
• When tracing installed software, USB devices, and network connections
• During insider threat investigations to reconstruct user actions
• For correlating registry timestamps with other forensic artifacts

Skill page

Source